{
 "slug": "funds-transfer-fraud-ftf-endorsement-prove-compliance",
 "topic_id": "TOPIC-065",
 "cluster": "Cyber Insurance & Risk Transfer",
 "tier": "Tier B",
 "title": "Proving out-of-band verification when the claim is filed",
 "summary": "Funds transfer fraud cover typically requires verification through a second channel. Proving it happened, months later, from phone notes and memory, is where claims stall.",
 "lede": "The reservation of rights letter asks forty questions. Several of them come down to one thing: show that someone verified the payment instructions through a channel other than the one that delivered them.",
 "date": "2024-09-13",
 "category": "Vertical",
 "author_id": "desmond-okafor-hale",
 "tags": [
  "funds transfer fraud",
  "insurance claims",
  "out of band verification",
  "evidence",
  "treasury",
  "coverage"
 ],
 "image_title": "Proving Out Of Band Verification",
 "schema": "Article",
 "key_takeaways": [
  "Verification requirements are usually conditions precedent — failure to prove them can defeat the claim regardless of how the loss occurred.",
  "Phone notes and call recordings are weak: incomplete, unstructured, and not bound to the specific payment.",
  "A signed confirmation over the rendered payment details produces exactly the artefact the condition asks for."
 ],
 "body": [
  {
   "type": "h2",
   "text": "What the endorsement typically requires"
  },
  {
   "type": "diagram",
   "kind": "chain",
   "alt": "The claim is decided on the procedure, not the fraud",
   "caption": "The loss is undisputed. What is disputed is whether you can prove the condition was met.",
   "nodes": [
    {
     "label": "Loss occurs",
     "sub": "fraud undisputed",
     "note": ""
    },
    {
     "label": "Reservation of rights",
     "sub": "40 questions",
     "note": "procedure"
    },
    {
     "label": "Evidence offered",
     "sub": "phone notes",
     "note": "weak",
     "bad": true
    },
    {
     "label": "Denied on the warranty",
     "sub": "not the loss",
     "note": "",
     "bad": true
    }
   ]
  },
  {
   "type": "p",
   "html": "Wordings differ and the pattern is consistent: for transfers above a threshold, or where instructions changed, the insured must verify the request through a means independent of the one that conveyed it."
  },
  {
   "type": "p",
   "html": "Where that is drafted as a condition precedent, failing to demonstrate it can defeat coverage even where the fraud is undisputed. The question at claim time is not whether you were defrauded but whether you did the thing the policy required."
  },
  {
   "type": "h2",
   "text": "Why phone-based proof fails"
  },
  {
   "type": "table",
   "head": [
    "Evidence offered",
    "Weakness"
   ],
   "rows": [
    [
     "A note in the payment file",
     "Says a call occurred; does not say what was verified"
    ],
    [
     "Call recording",
     "Often not retained; may not cover the relevant exchange"
    ],
    [
     "Phone system records",
     "Show a call to a number; not what was discussed"
    ],
    [
     "Employee recollection",
     "Months later, across many similar payments"
    ],
    [
     "Email confirming the call happened",
     "Same channel the fraud may have travelled on"
    ]
   ]
  },
  {
   "type": "p",
   "html": "The first row is the most common and the weakest. \"Verified with vendor by phone – JM\" is a note about a process, not evidence of what was confirmed."
  },
  {
   "type": "h2",
   "text": "The number question"
  },
  {
   "type": "p",
   "html": "A second issue that adjusters probe hard: which number was called, and where did it come from."
  },
  {
   "type": "p",
   "html": "If the number came from the email containing the changed instructions, the verification was not out of band in any meaningful sense — it went back to the attacker. Demonstrating that the number came from a previously established record is a separate evidentiary burden most organisations cannot meet."
  },
  {
   "type": "h2",
   "text": "What a signed confirmation contains"
  },
  {
   "type": "code",
   "text": "{\n  \"action\": \"payment_instruction.confirm\",\n  \"vendor\": \"Acme Supplies Ltd\",\n  \"vendor_ref\": \"V-4471\",\n  \"account_from\": \"****4417\",       # previous details on file\n  \"account_to\":   \"****9023\",       # what is being changed to\n  \"routing\": \"021000021\",\n  \"changed_fields\": [\"account\", \"routing\"],\n  \"channel\": \"independent — contact record on file since 2023-04-11\",\n  \"confirmed_by\": \"[named individual at the vendor]\",\n  \"our_approver\": \"[named individual]\",\n  \"at\": \"2026-02-10T11:04:00Z\",\n  \"signature\": \"...\"\n}"
  },
  {
   "type": "p",
   "html": "Every element an adjuster asks about is present: what changed, who confirmed, through which channel, when, and who at your organisation accepted it. One file replaces the forty-question exchange."
  },
  {
   "type": "h2",
   "text": "The counterparty signature"
  },
  {
   "type": "p",
   "html": "The strongest version has the vendor sign too. Their signature attests that they requested the change and that these are their details."
  },
  {
   "type": "p",
   "html": "This is harder to deploy — it requires the counterparty to participate — and it is worth pursuing for your largest and most frequent payees. Twenty vendors typically account for most of the payment value, and twenty counterparty enrolments is a tractable project."
  },
  {
   "type": "h2",
   "text": "Where to apply it"
  },
  {
   "type": "p",
   "html": "The trigger conditions in most wordings are the right scope, and they are narrower than all payments."
  },
  {
   "type": "ul",
   "items": [
    "Any change to an existing payee's banking details — the highest-signal event",
    "First payment to a new payee",
    "Payments above the policy threshold",
    "Any payment where the request arrived outside the normal process",
    "Urgent or expedited requests, which is where exceptions are invoked"
   ]
  },
  {
   "type": "p",
   "html": "The last bullet is the one to instrument first. Urgency is the attacker's tool and the exception path is where controls are waived."
  },
  {
   "type": "h2",
   "text": "Talking to your broker before the loss"
  },
  {
   "type": "p",
   "html": "Two questions worth asking at renewal rather than at claim."
  },
  {
   "type": "ol",
   "items": [
    "What specifically will the insurer accept as proof of out-of-band verification? Get the answer in writing.",
    "If we can produce a signed confirmation per the wording's trigger conditions, does that affect the sub-limit or the deductible?"
   ]
  },
  {
   "type": "p",
   "html": "The second question may get a no today. Asking it is how the market learns there is demand for a term that does not yet exist, and brokers are the right channel for that signal."
  },
  {
   "type": "h2",
   "text": "Why phone-based proof fails"
  },
  {
   "type": "table",
   "caption": "What gets offered, and why it does not hold",
   "head": [
    "Evidence",
    "Weakness"
   ],
   "rows": [
    [
     "A note in the payment file",
     "Says a call occurred, not what was verified"
    ],
    [
     "Call recording",
     "Frequently not retained, or missing the exchange"
    ],
    [
     "Phone system records",
     "A call to a number, not its content"
    ],
    [
     "Employee recollection",
     "Months later, across many similar payments"
    ],
    [
     "<strong style=\"font-weight:600\">Which number was called</strong>",
     "<strong style=\"font-weight:600\">If it came from the fraudulent email, it was not out of band</strong>"
    ]
   ]
  },
  {
   "type": "h2",
   "text": "Objections and honest limits"
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“The fraud is obvious so they must pay.”</strong> Where the verification requirement is drafted as a condition precedent, failing to prove it can defeat the claim independently of how the loss occurred."
  },
  {
   "type": "p",
   "html": "<strong style=\"font-weight:600\">“Our procedure is documented.”</strong> Documentation proves design. The adjuster is testing operation, for one payment, months afterwards."
  }
 ],
 "faq": [
  {
   "q": "Why can a verification requirement defeat a claim?",
   "a": "Where it is drafted as a condition precedent, failing to demonstrate it can defeat coverage even where the fraud itself is undisputed."
  },
  {
   "q": "Why are phone notes weak evidence?",
   "a": "They record that a call occurred, not what was verified. Recordings are often not retained, and recollection degrades across many similar payments."
  },
  {
   "q": "What is the number question?",
   "a": "Adjusters ask which number was called and where it came from. A number taken from the fraudulent email is not out of band in any meaningful sense."
  },
  {
   "q": "Should counterparties sign too?",
   "a": "It is the strongest version and harder to deploy. Start with the twenty payees that account for most of your payment value."
  },
  {
   "q": "What should be instrumented first?",
   "a": "The urgent or expedited path, where exceptions are invoked and where the attacker applies pressure."
  }
 ],
 "sources": [
  {
   "t": "NAIC — cyber insurance market report",
   "u": "https://content.naic.org/cipr-topics/cyber-risk"
  },
  {
   "t": "Published coverage disputes involving verification conditions."
  },
  {
   "t": "FBI IC3 2025 Internet Crime Report",
   "u": "https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf"
  },
  {
   "t": "Treasury association guidance on payment controls."
  }
 ],
 "related": [
  {
   "slug": "cyber-insurance-actuarial-crisis-deepfake-warranties",
   "title": "Underwriting on questionnaire answers",
   "category": "Definitional"
  },
  {
   "slug": "social-engineering-sub-limit-trap-10m-cyber",
   "title": "The social engineering sub-limit",
   "category": "Vertical"
  },
  {
   "slug": "account-masking-ap-systems-directly-enables-wire",
   "title": "Account masking in AP systems",
   "category": "Vertical"
  },
  {
   "slug": "forensic-accountants-guide-crypto-wire-theft-following",
   "title": "Anchoring a fraud investigation to hard evidence",
   "category": "Vertical"
  }
 ],
 "image": "https://cdn.twc.sh/images/igcache/Proving%20Out%20Of%20Band%20Verification/1200_630/blog.jpg",
 "wordcount": 847,
 "url": "/blog/funds-transfer-fraud-ftf-endorsement-prove-compliance.html",
 "reading_time": "4 min read",
 "meta_description": "Funds transfer fraud cover requires verification through a second channel. Proving it months later from phone notes is where claims stall.",
 "hub": {
  "slug": "topics/cyber-insurance",
  "title": "Cyber insurance and risk transfer"
 },
 "answer": "With an artefact, or not at all. Funds transfer fraud cover typically conditions payment on verification through a second channel, and the reservation-of-rights letter asks forty questions that reduce to one: show that someone verified this payment, through what channel, and what they confirmed.",
 "answer_q": "How do you prove out-of-band verification months later?",
 "glossary": [
  {
   "term": "Condition precedent",
   "def": "A requirement that must be satisfied for cover to respond; failing to prove it can defeat a claim."
  },
  {
   "term": "Reservation of rights",
   "def": "An insurer's notice that it is investigating while reserving the right to deny."
  },
  {
   "term": "Out-of-band",
   "def": "Through a channel independent of the one carrying the request — only as good as how the channel was obtained."
  }
 ],
 "checklist": {
  "title": "Producing claim-ready evidence",
  "id": "claim",
  "desc": "Four steps.",
  "steps": [
   {
    "name": "Capture what changed, not that a call happened.",
    "text": "Old and new account, and the fields that differ."
   },
   {
    "name": "Record which number was used and where it came from.",
    "text": "The pre-change record, not the request."
   },
   {
    "name": "Have the counterparty confirm where you can.",
    "text": "Your top payees are most of the exposure."
   },
   {
    "name": "Instrument the urgent path first.",
    "text": "Where exceptions are invoked and losses occur."
   }
  ]
 },
 "cta": {
  "title": "Where this fits in Manav",
  "html": "Manav produces the artefact underwriting and claims both lack: a per-transaction receipt an adjuster can verify without contacting the insured, and a measurable coverage rate across a defined scope.",
  "href": "../docs.html",
  "label": "See the evidence a claim needs"
 }
}